pentest mcp server changelog

https://raw.githubusercontent.com/cyanheads/pentest-mcp-server/HEAD/AGENTS.md

− **Version:** 0.2.0− **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.15`− **MCP SDK:** `@modelcontextprotocol/server` ^2.3.1 (via framework)− **Zod:** ^4.6.6− | `bun run lint:packaging` | Run packaging-surface checks standalone |− `bun run bundle` builds, packs, and cleans a `.mcpb` extension bundle for one-click install in Claude Desktop. `scripts/clean-mcpb.ts` prunes dev dependencies and strips dependency-shipped agent docs and platform-specific native bindings that root-anchored `.mcpbignore` patterns cannot reach. MCPB is stdio-only — HTTP and Cloudflare Workers deployments are unaffected. Consumers who don't need it can delete `manifest.json` and `.mcpbignore`; `lint:packaging` skips cleanly.− **Every release goes through a release PR, straight-through** — `git-wrapup`'s "Release PR mode", mode `straight-through`. One run: `git-wrapup` lands the commit stack on `release/<version>`, pushes it, and opens the PR (title = the release commit subject, body = the release digest: theme line, `## Changes`, `## Gates`, changelog link last); `release-and-publish` then fast-forwards `main` locally with `git merge --ff-only`, creates the tag on `main`'s tip, pushes `main` and the tag, deletes the + **Version:** 0.3.0+ **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.18`+ **MCP SDK:** `@modelcontextprotocol/server` ^2.4.0 (via framework)+ **Zod:** ^4.6.7+ | `add-skill` | Author an agent-facing skill in root `skills/`, validate it, and wire its delivery |+ | `bun run lint:packaging` | Validate bundle exclusions, plugin manifests, and any published `skills/` tree |+ ## Agent plugins+ Root `plugin.json` and `mcp.json` implement Agent Plugins 1.0.0. Keep fixed stdio settings in `mcp.json`; user-supplied variables remain in the Codex overlay's `env_vars` and Claude overlay's `userConfig`. Preserve `.codex-plugin/plugin.json`'s `mcpServers` pointer so Codex forwards those variables.+ Root `skills/` is opt-in and author-managed, separate from development guidance in `framework-skills/`. Publishing a skill requires npm `files`, Docker copies, and `createApp({ skills: 'skills' })` wiring together; maintenance never creates that tree.+ `bun run bundle` builds, packs, and cleans a `.mcpb` extension bundle for one-click install in Claude Desktop. Every root development path needs a root-anchored `.mcpbignore` line; root `skills/` ships when present. `scripts/clean-mcpb.ts` prunes dev dependencies, dependency agent docs, platform-specific native bindings, node-gyp build output, and framework build-only files. Its agent-doc selector matches package-root paths so SDK runtime modules such as `dist/ext/skills/` survive. MCPB is stdio+ **Every release goes through a gated release PR** — `git-wrapup`'s "Release PR mode", mode `gated`. Three separate runs, never one: `git-wrapup` lands the commit stack on `release/<version>`, pushes it, and opens the PR (title = the release commit subject, body = the release digest: theme line, `## Changes`, `## Gates`, changelog link last); `release-pr-review` reviews and fixes on that branch (each fix an ordinary commit on top of the stack, pushed plainly — nothing already pushed is ever rewri

• + pentest-guide

version

0.2.0 → 0.3.0

https://raw.githubusercontent.com/cyanheads/pentest-mcp-server/HEAD/AGENTS.md

− **Version:** 0.1.10− **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.14`− **MCP SDK:** `@modelcontextprotocol/server` ^2.2.0 (via framework; lock-resolved 2.3.1)− **Zod:** ^4.6.5− Every tool that produces methodology or payload content (`pentest_guide`, `pentest_generate_payloads`, `pentest_encode`) has a required `authorized_use_reminder` output field. The `format()` function MUST render it as the first line of every `content[]` response:−       pentest-guide.tool.ts             # Step-by-step methodology playbook by vector−       pentest-encode.tool.ts            # Encoding chain transformer with decode explanation− | `bun run lint:mcp` | Run the MCP definition linter standalone |− **CI is one file.** `.github/workflows/codeql.yml` is the only GitHub Actions workflow. Verification runs locally through `devcheck`, tests, and release gates.− `bun run bundle` produces a `.mcpb` extension bundle for one-click install in Claude Desktop. MCPB is stdio-only — HTTP and Cloudflare Workers deployments are unaffected. Consumers who don't need it can delete `manifest.json` and `.mcpbignore`; `lint:packaging` skips cleanly.− **Adding an env var requires both files:** `server.json` (registry discovery, `environmentVariables[]`) and `manifest.json` (bundle install UX, `mcp_config.env` + `user_config`). `lint:packaging` (run by `devcheck`) verifies the env var names match.+ **Version:** 0.2.0+ **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.15`+ **MCP SDK:** `@modelcontextprotocol/server` ^2.3.1 (via framework)+ **Zod:** ^4.6.6+ Every tool that produces methodology or payload content (`pentest_get_guide`, `pentest_generate_payloads`, `pentest_encode_payload`) has a required `authorized_use_reminder` output field. The `format()` function MUST render it as the first line of every `content[]` response:+       pentest-get-guide.tool.ts         # Step-by-step methodology playbook by vector+       pentest-encode-payload.tool.ts    # Encoding chain transformer with decode explanation+ | `bun run lint:mcp` | Run the MCP definition linter standalone (rule catalog: `api-linter` skill) |+ **CI is one file.** `.github/workflows/codeql.yml` is the only GitHub Actions workflow. It runs while CodeQL default setup is off. Verification runs locally through `devcheck`, tests, and release gates.+ `bun run bundle` builds, packs, and cleans a `.mcpb` extension bundle for one-click install in Claude Desktop. `scripts/clean-mcpb.ts` prunes dev dependencies and strips dependency-shipped agent docs and platform-specific native bindings that root-anchored `.mcpbignore` patterns cannot reach. MCPB is stdio-only — HTTP and Cloudflare Workers deployments are unaffected. Consumers who don't need it can delete `manifest.json` and `.mcpbignore`; `lint:packaging` skips cleanly.+ **Adding an env var requires both files:** `server.json` (registry discovery, `environmentVariables[]`) and `manifest.json` (bundle install UX, `mcp_config.env` + `user_config`). `lint:packaging` (run by `devcheck`) verifies the env var names match, every `user_config` option is wired into `mcp_config.env` as `"X": "${user_config.X}"`, and optional string options carry `"default": ""`. The host substitutes no other form; `"${X}"` reaches the server literally.

• + pentest_get_guide
• + pentest_encode_payload
• − pentest_guide
• − pentest_encode

env_vars

MCP_LOG_LEVEL → PENTEST_ENABLE_PAYLOAD_GENERATION, MCP_LOG_LEVEL

version

0.1.10 → 0.2.0

https://raw.githubusercontent.com/cyanheads/pentest-mcp-server/HEAD/AGENTS.md

− **Version:** 0.1.9− **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.6`− **MCP SDK:** `@modelcontextprotocol/server` / `@modelcontextprotocol/client` ^2.0.0 (via framework)− - **Detection + mitigation are required, not optional.** Every technique, finding, and payload object in the output schema has non-optional `detection` and `mitigation` fields. Do not relax them.− import { notFound } from '@cyanheads/mcp-ts-core/errors';−         ctx.recoveryFor('no_match'),− | `ctx.recoveryFor` | Resolves a declared error contract's recovery string into wire-ready `data.recovery.hint`. |− | `ctx.requestId` | Unique request ID. |− | `ctx.tenantId` | Tenant ID from JWT or `'default'` for stdio. |− **Recommended: typed error contract.** Declare `errors: [{ reason, code, when, recovery, retryable? }]` on `tool()` / `resource()` to receive `ctx.fail(reason, …)` typed against the reason union. TypeScript catches typos at compile time, `data.reason` is auto-populated for observability, and the linter enforces conformance against the handler body. `recovery` is required (≥ 5 words, lint-validated) and is the single source of truth for the agent's next move. Pass `ctx.recoveryFor('reason')` as t−   if (!item) {−     throw ctx.fail('no_match', `No item ${input.id}`, ctx.recoveryFor('no_match'));−   }− throw new McpError(JsonRpcErrorCode.DatabaseError, 'Connection failed', { pool: 'primary' });− Skills are modular instructions in `framework-skills/` at the project root. Read them directly when a task matches — e.g., `framework-skills/add-tool/SKILL.md` when adding a tool.− | `devcheck` | Lint, format, typecheck, audit |− | `git-wrapup` | Land working-tree changes as a versioned commit + annotated tag — version bump, changelog, verify, tag. Local only. |− | `release-and-publish` | Push + npm + MCP Registry + GH Release + Docker. Picks up from `git-wrapup` |− | `api-context` | Context interface, logger, state, multi-round-trip input, enrichment, and content blocks |− | `bun run audit:refresh` | Delete `bun.lock`, reinstall, and re-run `bun audit`. Use when `devcheck` flags a transitive advisory — Bun's `update` is sticky on transitive resolutions, so the advisory may be a stale-lockfile false positive. If it survives the refresh, it's real. |− security: false                            # optional — true flags security fixes− `breaking: true` renders a `· ⚠️ Breaking` badge — use it when consumers must update code on upgrade (signature changes, removed APIs, config renames). `security: true` renders a `· 🛡️ Security` badge and pairs with a `## Security` body section. When both are set, badges render `· ⚠️ Breaking · 🛡️ Security`.− **Section order** (Keep a Changelog): Added, Changed, Deprecated, Removed, Fixed, Security. Include only sections with entries — don't ship empty headers.− **Every release goes through a release PR, straight-through** — `git-wrapup`'s "Release PR mode", mode `straight-through`. One run: `git-wrapup` lands the commit stack on `release/<version>`, pushes it, and opens the PR (title = the release commit subject, body = the changelog entry plus a gates section); `release-and-publish` then fast-forwards `main` locally with `git merge --ff-only`, creates the tag on `main`'s tip, pushes `main` and the tag, deletes the branch, and publishes. A caller's bri− - [ ] `.codex-plugin/plugin.json` populated — `name`, `version`, `description`, `repository`, `license` from `package.json`; `interface.displayName` = package name; `interface.shortDescription` from `package.json` description− - [ ] `.codex-plugin/mcp.json` updated — server name key matches `package.json` name; env vars added for any required API keys− - [ ] `.claude-plugin/plugin.json` populated — `name`, `version`, `description`, `repository`, `license` from `package.json`; inline `mcpServers` entry with server name key, env vars for any required API keys+ **Version:** 0.1.10+ **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.14`+ **MCP SDK:** `@modelcontextprotocol/server` ^2.2.0 (via framework; lock-resolved 2.3.1)+ - **Detection and remediation context is required.** Keep detection and mitigation context required on techniques and payloads, and `detection` and `remediation` required on response findings. Do not relax these contracts.+ import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';+ | `ctx.requestId` | Framework-generated request ID shared by call records and error `data.requestId`. |+ | `ctx.tenantId` | Tenant ID from JWT or `'default'` for stdio and HTTP with auth off. |+ **Recommended: typed error contract.** Declare `errors: [{ reason, code, when, recovery, retryable?, severity?, thrownBy? }]` on `tool()` / `resource()` to receive `ctx.fail(reason, …)` typed against the reason union. TypeScript catches typos at compile time, `data.reason` is auto-populated for observability, linter enforces conformance against the handler body. `recovery` is required (≥ 5 words, lint-validated) — the single source of truth for the agent's next move. The framework puts it on the+   if (!item) throw ctx.fail('no_match', `No item ${input.id}`);+ throw new McpError(JsonRpcErrorCode.InitializationFailed, 'Connection failed', { pool: 'primary' });+ Skills are modular instructions in `framework-skills/` at the project root. Read them directly when a task matches — e.g., `framework-skills/add-tool/SKILL.md` when adding a tool. `bun run list-skills` prints the full registry. The directory is deliberately not `skills/`: Claude Code and Codex auto-load a plugin's root `skills/`, so a server that ships `.claude-plugin/` or `.codex-plugin/` would hand these development skills to every agent that installs it. Keep `skills/` free for skills meant f+ | `git-wrapup` | Land working-tree changes as a commit stack — version bump, changelog, verify, commit by concern, release commit on top. No tag, no push to main; opens the release PR when the project declares release PR mode |+ | `release-pr-review` | Review pass on an open release PR — simplifier + correctness review, fixes as ordinary commits on top of the stack, PR body kept in sync. Release PR mode only |+ | `release-and-publish` | Fast-forward merge (release PR mode) + tag + push + npm + MCP Registry + GH Release + Docker. Picks up from `git-wrapup` |+ | `techniques` | Catalog of response/data-shaping techniques — overflow handling, payload shaping, retrieval patterns |+ | `api-context` | Context interface, RequestContext, logger, state, multi-round-trip input |+ | `api-mirror` | MirrorService: persistent self-refreshing local mirror (embedded SQLite + FTS5) of a bulk upstream dataset — Tier 3 opt-in |+ | `bun run audit:fix` | Upgrade vulnerable packages to the lowest safe version within existing ranges; `--dry-run` previews. |+ | `bun run audit:refresh` | Delete `bun.lock` and reinstall — last resort after `audit:fix`, `bun update <name>`, and `bun dedupe`; re-resolves every ranged dependency. |+ **CI is one file.** `.github/workflows/codeql.yml` is the only GitHub Actions workflow. Verification runs locally through `devcheck`, tests, and release gates.+ security: false                            # optional — true for fixes in this server's own code, never a dependency CVE bump+ `breaking: true` renders a `· ⚠️ Breaking` badge — use it when consumers must update code on upgrade (signature changes, removed APIs, config renames). `security: true` renders a `· 🛡️ Security` badge and pairs with a `## Security` body section; use it only for fixes in this server's own code, and record dependency CVE bumps under `## Dependencies`. When both are set, badges render `· ⚠️ Breaking · 🛡️ Security`.+ **Section order** (Keep a Changelog): Added, Changed, Deprecated, Removed, Fixed, Security, then Dependencies. Include only sections with entries — don't ship empty headers.+ **Every release goes through a release PR, straight-through** — `git-wrapup`'s "Release PR mode", mode `straight-through`. One run: `git-wrapup` lands the commit stack on `release/<version>`, pushes it, and opens the PR (title = the release commit subject, body = the release digest: theme line, `## Changes`, `## Gates`, changelog link last); `release-and-publish` then fast-forwards `main` locally with `git merge --ff-only`, creates the tag on `main`'s tip, pushes `main` and the tag, deletes the + - [ ] `.codex-plugin/plugin.json` populated — `name`, `version`, `description`, `repository`, `license` from `package.json`; `interface.displayName` = the unscoped repo name (never the npm scope — `lint:packaging` enforces this); `interface.shortDescription` from `package.json` description+ - [ ] `.codex-plugin/mcp.json` updated — server name key is the unscoped repo name; every user-supplied variable (API key, contact email, instance URL) is listed in `env_vars` so Codex forwards it from the user's environment. Never write `"KEY": ""` into `env` — an empty value replaces the user's exported key and is read as unset+ - [ ] `.claude-plugin/plugin.json` populated — `name`, `version`, `description`, `author`, `repository`, `license`, `keywords` from `package.json`; inline `mcpServers` entry keyed by the unscoped repo name. Every user-supplied variable is declared under `userConfig` (`type`, `title`, `description`; `sensitive: true` for keys and tokens; `required: true` or `default: ""`) and referenced from `env` as `"KEY": "${user_config.<option>}"` — mirror the `user_config` block in `manifest.json`. Never wri

version

0.1.9 → 0.1.10